I have a piece of code that uses CSOM to get search results from Sharepoint.

using (var clientContext = new ClientContext(serverUrl)
    Credentials = CredentialCache.DefaultCredentials
    var keywordQuery = new KeywordQuery(clientContext);
    keywordQuery.QueryText = query;
    var searchExecutor = new SearchchExecutor(clientContext);
    var results = searchExecutor.ExecuteQuery(keywordQuery);

This code works when it's executed on the Sharepoint server locally, when I'm logged in.

However if I put this piece of code in an web application hosted on IIS, I get 401 Unauthorized on ExecuteQuery()


I also tried using the HttpClient like this:

using (var handler = new HttpClientHandler()
    UseDefaultCredentials = true
    using (var client = new HttpClient(handler))
        var requri = new Uri("https://sharepoint.mydomain.com.pl/_api/search/query");
        HttpResponseMessage response = await client.GetAsync(requri);

This also gets me 401 error.

But when I tried the "https://sharepoint.mydomain.com.pl/sites/search/_api/search/query" I got a different error: Microsoft.Office.Server.Search.REST.SearchServiceException: "The SafeQueryPropertiesTemplateUrl \"The SafeQueryPropertiesTemplateUrl "{0}" is not a valid URL.\" is not a valid URL." but I found out that this is likely to be an unauthorized error as well.

What's interesting, both cases (calling the main site collection ('/') or the search site collection ('sites/search') on IIS Express environment works.

The Windows authentication is enabled in IIS application settings enter image description here

as well as in Sharepoint Central administration enter image description here

1 Answer 1


Instead of authenticating with the default credentials, we need to pass the credential explicitly using the NetworkCredential where we need to pass the username and password.

Connect to SharePoint from Asp. Net using NetworkCredential:

using (srcContext = new  ClientContext("siteURL"))
     string userName="MyUserName"
     string password="MyPassword"
     NetworkCredential credentials = new NetworkCredential(userName, password); 
  • Well, that's not an option. I have integrated authentication enabled on my site and I need to reuse it for the Sharepoint connection.
    – Szybki
    Mar 27, 2020 at 8:00
  • What account are you using for the application pool of the Web Application where this code is running? Does that account have permission to your SharePoint site? Mar 27, 2020 at 21:18
  • @Szybki if this is multihop (client-webserver-SharePoint) then Windows authentication isn’t enough. You need to set up Kerberos Auth (as NTLM cannot double-hop). You’ll need SPNs set up alto match the host names and accounts used for your SharePoint site and your website.
    – Greg W
    Mar 28, 2020 at 1:17
  • @GregW I've set SPN like this: setspn -U -S HTTP/server-name domain\username where server-name is the name of the server where both sharepoint and my webapp is running and the username is the name of the account used to run the sharepoint application pool. @MatiurRahman the account has an access to the sharepoint. But I'm still getting 401. Do I need to set up some additional permission for the account? Or did I miss something?
    – Szybki
    Mar 30, 2020 at 22:33
  • Is the account running the website the same as the account running the SharePoint site? Your SPN should be set to the hostname of each website (without the port number). Is the hostname the same for your web site and SharePoint site? Since it’s the same server, you could also be running into loop back prevention if you’re not using the server’s name to connect.
    – Greg W
    Mar 31, 2020 at 4:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.